Read the docs
TI-2017-02997 Aliases CVE-2017-3912GHSA-f9jm-979c-8px2

Improper authentication in McAfee Application Control and Change Control

Priority LOW 34CWE-274Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.

Why it matters now

EPSS 0.00413 35th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMcAfee Application Control and Change Control (MACC)7.0.1—No fix listedCNA
McAfeeMcAfee Application Control and Change Control (MACC)6.2.0—No fix listedCNA
  • McAfee Application Control and Change Control (MACC) VendorMcAfee Affected 7.0.1 Fixed in — No fix listed CNA
  • McAfee Application Control and Change Control (MACC) VendorMcAfee Affected 6.2.0 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:application_and_change_control:6.2.0:*:*:*:*:*:*:*6.2.0VulnerableMcAfee
cpe:2.3:a:mcafee:application_and_change_control:7.0.1:*:*:*:*:*:*:*7.0.1VulnerableMcAfee
  • cpe:2.3:a:mcafee:application_and_change_control:6.2.0:*:*:*:*:*:*:* Versions 6.2.0 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:application_and_change_control:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·McAfee

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-3912
  2. 2026-10-03 Alias added: GHSA-f9jm-979c-8px2

References

Other 1

  • TI-2020-05937 Improper privilege assignment vulnerability in the installer component of MACC CVSS 3.1HIGH 8.2
  • TI-2021-11827 Improper privilege management in McAfee Application and Change Control CVSS 3.1HIGH 7.8
  • TI-2020-05867 MACC installer DLL side loading CVSS 3.1HIGH 7.8
  • TI-2020-05914 Cross Site Scripting vulnerability in ePO extension of MACC CVSS 3.1MEDIUM 4.8
  • TI-2023-00213 Improper privilege management in Trellix Application and Change Control CVSS 3.1MEDIUM 4.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences